What is the primary purpose of an access review in an identity governance program?

To verify that users still need their current access and remove unnecessary permissions

To enforce multi-factor authentication for all users

To monitor user sign-in behavior for anomalies

To automatically grant access to all users based on their job title

What is the primary purpose of a Privileged Access Workstation (PAW)?

To provide a dedicated, hardened device for performing privileged administrative tasks

To allow administrators to access the internet freely while working

To provide a device for testing new software without security controls

To replace all user workstations in the organization

A large enterprise uses Microsoft Entra ID and has a separate team that manages the Azure subscription for a line-of-business application. The team currently has permanent Owner role assignments on that subscription. The security team wants to apply the enterprise access model to reduce standing access while still allowing the team to perform their daily management tasks. What should you configure?

Replace the Owner role with the Contributor role for all team members.

Assign the team to a custom role that includes only the permissions they need and keep it permanent.

Convert the Owner role assignments to eligible in Privileged Identity Management and require approval for activation.

Keep the permanent Owner assignments but add a conditional access policy that requires multi-factor authentication for all Azure portal sign-ins.

Which AD DS security best practice helps mitigate the risk of credential theft from memory on domain controllers?

Using the Recycle Bin for deleted objects

Microsoft Certified:Cybersecurity Architect Expert

Domain 2Objective 3

Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 3)

Part of the Design security operations, identity, and compliance capabilities domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

7concepts

25–30%of the exam

Questions 11–15

11foundation · easy
What is the primary purpose of an access review in an identity governance program?
Select an answer first
12foundation · easy
What is the primary purpose of a Privileged Access Workstation (PAW)?
Select an answer first
13application · medium
A large enterprise uses Microsoft Entra ID and has a separate team that manages the Azure subscription for a line-of-business application. The team currently has permanent Owner role assignments on that subscription. The security team wants to apply the enterprise access model to reduce standing access while still allowing the team to perform their daily management tasks. What should you configure?
Select an answer first
14foundation · easy
Which AD DS security best practice helps mitigate the risk of credential theft from memory on domain controllers?
Select an answer first
15foundation · easy
Which Microsoft Entra ID feature allows you to create access packages to govern user access to resources such as groups, apps, and SharePoint sites?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Securing Privileged Access SC-100 Practice Questions (Page 3)

Questions 11–15

What is the primary purpose of an access review in an identity governance program?

What is the primary purpose of a Privileged Access Workstation (PAW)?

Which AD DS security best practice helps mitigate the risk of credential theft from memory on domain controllers?

Which Microsoft Entra ID feature allows you to create access packages to govern user access to resources such as groups, apps, and SharePoint sites?

Keep studying — Design security operations, identity, and compliance capabilities